Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2016-8677

The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.

VectorNETWORK

PublishedFeb 15, 2017, 21:59

Published Bycve@mitre.org

Base Score

Score8.8

Affected Versions

No affected versions found.

References

http://lists.opensuse.org/opensuse-updates/2016-10/msg00107.html
http://www.debian.org/security/2016/dsa-3726
http://www.openwall.com/lists/oss-security/2016/10/16/1
http://www.securityfocus.com/bid/93598
https://blogs.gentoo.org/ago/2016/10/07/imagemagick-memory-allocate-failure-in-acquirequantumpixels-quantum-c/
https://bugzilla.redhat.com/show_bug.cgi?id=1385698
https://github.com/ImageMagick/ImageMagick/commit/6e48aa92ff4e6e95424300ecd52a9ea453c19c60
https://github.com/ImageMagick/ImageMagick/issues/268

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK